Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 22:32
Behavioral task
behavioral1
Sample
081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe
-
Size
212KB
-
MD5
081a7d566ac990d82a1ed60b834a22b0
-
SHA1
ca5ad62e37ae1193d821f861520542ffdbbdff11
-
SHA256
e62497ff6d4effe189801b4761939b082811183d69ce45196f025bf07b7a5c72
-
SHA512
8e2b9ae3f8ff155e6b6155419e7eec1f30a3216c435db666fead1c9d6562090e1f67d2de3f78f86a13ac421b18a7b44ee43544bf4f5cd66057a5c75f0122396e
-
SSDEEP
6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+lZ:V4wFHoSBK/ubLcfv
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/2392-0-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1876-9-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1300-26-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2172-35-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2684-44-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2596-53-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2488-64-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2460-81-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2800-100-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2972-98-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2356-151-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1568-161-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1208-171-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1704-187-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3028-205-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3028-204-0x00000000002A0000-0x00000000002D4000-memory.dmp family_blackmoon behavioral1/memory/1320-214-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1364-234-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/780-248-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2904-257-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2072-266-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2076-283-0x0000000001B60000-0x0000000001B94000-memory.dmp family_blackmoon behavioral1/memory/2076-285-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1692-301-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2420-314-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3040-322-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2872-341-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2240-387-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2636-389-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2440-425-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2040-464-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/604-488-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/268-508-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/304-560-0x00000000002D0000-0x0000000000304000-memory.dmp family_blackmoon behavioral1/memory/2188-580-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2900-1035-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2392-0-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\9hhnnt.exe family_berbew behavioral1/memory/1876-9-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\lrlrxlr.exe family_berbew behavioral1/memory/1300-17-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1300-21-0x0000000000220000-0x0000000000254000-memory.dmp family_berbew behavioral1/memory/1300-26-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\btnhnh.exe family_berbew behavioral1/memory/2172-35-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\pjdpj.exe family_berbew C:\xlrlfxx.exe family_berbew behavioral1/memory/2684-44-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\bthtbt.exe family_berbew behavioral1/memory/2596-53-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\1vjpp.exe family_berbew behavioral1/memory/2488-64-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\rrxrlxr.exe family_berbew behavioral1/memory/2460-72-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2460-81-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\hhbnhn.exe family_berbew C:\vpppd.exe family_berbew C:\9lxrxfl.exe family_berbew C:\nhhhnt.exe family_berbew behavioral1/memory/2800-100-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2972-98-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\pjdvv.exe family_berbew C:\xrrfxxx.exe family_berbew behavioral1/memory/812-124-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\3rlllfl.exe family_berbew C:\nhbnhn.exe family_berbew behavioral1/memory/1264-140-0x00000000002C0000-0x00000000002F4000-memory.dmp family_berbew behavioral1/memory/2356-151-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\1vjpj.exe family_berbew C:\xlfrfrl.exe family_berbew behavioral1/memory/1568-161-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\1nnnbn.exe family_berbew behavioral1/memory/1208-171-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\pppvp.exe family_berbew C:\7fxflrx.exe family_berbew behavioral1/memory/1704-187-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\5bbbtn.exe family_berbew C:\vppjp.exe family_berbew behavioral1/memory/3028-205-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/3028-204-0x00000000002A0000-0x00000000002D4000-memory.dmp family_berbew behavioral1/memory/1320-214-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\xfxlrfl.exe family_berbew behavioral1/memory/696-215-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\hbhbhh.exe family_berbew C:\dvdjp.exe family_berbew behavioral1/memory/1364-234-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\pvjvj.exe family_berbew C:\ttnbnt.exe family_berbew behavioral1/memory/780-248-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2904-257-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\7pdjp.exe family_berbew C:\1ffxfxf.exe family_berbew behavioral1/memory/2072-266-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\ttthbn.exe family_berbew C:\bnnnnn.exe family_berbew behavioral1/memory/2076-285-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1236-294-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1692-301-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2420-314-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/3040-322-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
9hhnnt.exelrlrxlr.exebtnhnh.exepjdpj.exexlrlfxx.exebthtbt.exe1vjpp.exerrxrlxr.exehhbnhn.exevpppd.exe9lxrxfl.exenhhhnt.exepjdvv.exexrrfxxx.exe3rlllfl.exenhbnhn.exe1vjpj.exexlfrfrl.exe1nnnbn.exepppvp.exe7fxflrx.exe5bbbtn.exevppjp.exexfxlrfl.exehbhbhh.exedvdjp.exepvjvj.exettnbnt.exe7pdjp.exe1ffxfxf.exettthbn.exebnnnnn.exerlffxfr.exe3rllrlr.exenhbbtb.exe7jvjd.exefxlffxf.exellfrlxl.exennthbh.exettbbbh.exedjppj.exerxllxlr.exeffxlflx.exettnnbn.exedvpvj.exevppjd.exe3xlxrxl.exe1fxrxfl.exehbtthn.exenhnthn.exevvvdp.exeffxllxx.exefffrlrf.exebbhhth.exe3pdjp.exevpvvv.exeffxflrx.exexrxllfx.exebtntnh.exevvpdj.exevjpjd.exe1xrxflf.exettbbhh.exettnttt.exepid process 1876 9hhnnt.exe 1300 lrlrxlr.exe 2172 btnhnh.exe 2684 pjdpj.exe 2596 xlrlfxx.exe 2720 bthtbt.exe 2488 1vjpp.exe 2460 rrxrlxr.exe 2232 hhbnhn.exe 2972 vpppd.exe 2800 9lxrxfl.exe 2812 nhhhnt.exe 2956 pjdvv.exe 812 xrrfxxx.exe 1264 3rlllfl.exe 2356 nhbnhn.exe 1568 1vjpj.exe 768 xlfrfrl.exe 1208 1nnnbn.exe 1704 pppvp.exe 2896 7fxflrx.exe 3028 5bbbtn.exe 1320 vppjp.exe 696 xfxlrfl.exe 600 hbhbhh.exe 1364 dvdjp.exe 780 pvjvj.exe 2904 ttnbnt.exe 2072 7pdjp.exe 2208 1ffxfxf.exe 2076 ttthbn.exe 1528 bnnnnn.exe 1236 rlffxfr.exe 1692 3rllrlr.exe 2420 nhbbtb.exe 3040 7jvjd.exe 3056 fxlffxf.exe 2060 llfrlxl.exe 2672 nnthbh.exe 2872 ttbbbh.exe 2500 djppj.exe 2732 rxllxlr.exe 2468 ffxlflx.exe 2520 ttnnbn.exe 2476 dvpvj.exe 2240 vppjd.exe 2636 3xlxrxl.exe 2816 1fxrxfl.exe 2808 hbtthn.exe 2812 nhnthn.exe 2956 vvvdp.exe 2440 ffxllxx.exe 1676 fffrlrf.exe 2184 bbhhth.exe 1724 3pdjp.exe 352 vpvvv.exe 772 ffxflrx.exe 768 xrxllfx.exe 2040 btntnh.exe 1944 vvpdj.exe 1704 vjpjd.exe 2236 1xrxflf.exe 604 ttbbhh.exe 992 ttnttt.exe -
Processes:
resource yara_rule behavioral1/memory/2392-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\9hhnnt.exe upx behavioral1/memory/1876-9-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lrlrxlr.exe upx behavioral1/memory/1300-17-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1300-21-0x0000000000220000-0x0000000000254000-memory.dmp upx behavioral1/memory/1300-26-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\btnhnh.exe upx behavioral1/memory/2172-35-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pjdpj.exe upx C:\xlrlfxx.exe upx behavioral1/memory/2684-44-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bthtbt.exe upx behavioral1/memory/2596-53-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\1vjpp.exe upx behavioral1/memory/2488-64-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rrxrlxr.exe upx behavioral1/memory/2460-72-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2460-81-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\hhbnhn.exe upx C:\vpppd.exe upx C:\9lxrxfl.exe upx C:\nhhhnt.exe upx behavioral1/memory/2800-100-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2972-98-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pjdvv.exe upx C:\xrrfxxx.exe upx behavioral1/memory/812-124-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3rlllfl.exe upx C:\nhbnhn.exe upx behavioral1/memory/1264-140-0x00000000002C0000-0x00000000002F4000-memory.dmp upx behavioral1/memory/2356-151-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1vjpj.exe upx C:\xlfrfrl.exe upx behavioral1/memory/1568-161-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\1nnnbn.exe upx behavioral1/memory/1208-171-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pppvp.exe upx C:\7fxflrx.exe upx behavioral1/memory/1704-187-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\5bbbtn.exe upx C:\vppjp.exe upx behavioral1/memory/3028-205-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1320-214-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xfxlrfl.exe upx behavioral1/memory/696-215-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\hbhbhh.exe upx C:\dvdjp.exe upx behavioral1/memory/1364-234-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pvjvj.exe upx C:\ttnbnt.exe upx behavioral1/memory/780-248-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2904-257-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\7pdjp.exe upx C:\1ffxfxf.exe upx behavioral1/memory/2072-266-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ttthbn.exe upx C:\bnnnnn.exe upx behavioral1/memory/2076-285-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1236-294-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1692-301-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2420-314-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/3040-322-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2872-341-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe9hhnnt.exelrlrxlr.exebtnhnh.exepjdpj.exexlrlfxx.exebthtbt.exe1vjpp.exerrxrlxr.exehhbnhn.exevpppd.exe9lxrxfl.exenhhhnt.exepjdvv.exexrrfxxx.exe3rlllfl.exedescription pid process target process PID 2392 wrote to memory of 1876 2392 081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe 9hhnnt.exe PID 2392 wrote to memory of 1876 2392 081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe 9hhnnt.exe PID 2392 wrote to memory of 1876 2392 081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe 9hhnnt.exe PID 2392 wrote to memory of 1876 2392 081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe 9hhnnt.exe PID 1876 wrote to memory of 1300 1876 9hhnnt.exe lrlrxlr.exe PID 1876 wrote to memory of 1300 1876 9hhnnt.exe lrlrxlr.exe PID 1876 wrote to memory of 1300 1876 9hhnnt.exe lrlrxlr.exe PID 1876 wrote to memory of 1300 1876 9hhnnt.exe lrlrxlr.exe PID 1300 wrote to memory of 2172 1300 lrlrxlr.exe btnhnh.exe PID 1300 wrote to memory of 2172 1300 lrlrxlr.exe btnhnh.exe PID 1300 wrote to memory of 2172 1300 lrlrxlr.exe btnhnh.exe PID 1300 wrote to memory of 2172 1300 lrlrxlr.exe btnhnh.exe PID 2172 wrote to memory of 2684 2172 btnhnh.exe pjdpj.exe PID 2172 wrote to memory of 2684 2172 btnhnh.exe pjdpj.exe PID 2172 wrote to memory of 2684 2172 btnhnh.exe pjdpj.exe PID 2172 wrote to memory of 2684 2172 btnhnh.exe pjdpj.exe PID 2684 wrote to memory of 2596 2684 pjdpj.exe xlrlfxx.exe PID 2684 wrote to memory of 2596 2684 pjdpj.exe xlrlfxx.exe PID 2684 wrote to memory of 2596 2684 pjdpj.exe xlrlfxx.exe PID 2684 wrote to memory of 2596 2684 pjdpj.exe xlrlfxx.exe PID 2596 wrote to memory of 2720 2596 xlrlfxx.exe bthtbt.exe PID 2596 wrote to memory of 2720 2596 xlrlfxx.exe bthtbt.exe PID 2596 wrote to memory of 2720 2596 xlrlfxx.exe bthtbt.exe PID 2596 wrote to memory of 2720 2596 xlrlfxx.exe bthtbt.exe PID 2720 wrote to memory of 2488 2720 bthtbt.exe 1vjpp.exe PID 2720 wrote to memory of 2488 2720 bthtbt.exe 1vjpp.exe PID 2720 wrote to memory of 2488 2720 bthtbt.exe 1vjpp.exe PID 2720 wrote to memory of 2488 2720 bthtbt.exe 1vjpp.exe PID 2488 wrote to memory of 2460 2488 1vjpp.exe rrxrlxr.exe PID 2488 wrote to memory of 2460 2488 1vjpp.exe rrxrlxr.exe PID 2488 wrote to memory of 2460 2488 1vjpp.exe rrxrlxr.exe PID 2488 wrote to memory of 2460 2488 1vjpp.exe rrxrlxr.exe PID 2460 wrote to memory of 2232 2460 rrxrlxr.exe hhbnhn.exe PID 2460 wrote to memory of 2232 2460 rrxrlxr.exe hhbnhn.exe PID 2460 wrote to memory of 2232 2460 rrxrlxr.exe hhbnhn.exe PID 2460 wrote to memory of 2232 2460 rrxrlxr.exe hhbnhn.exe PID 2232 wrote to memory of 2972 2232 hhbnhn.exe vpppd.exe PID 2232 wrote to memory of 2972 2232 hhbnhn.exe vpppd.exe PID 2232 wrote to memory of 2972 2232 hhbnhn.exe vpppd.exe PID 2232 wrote to memory of 2972 2232 hhbnhn.exe vpppd.exe PID 2972 wrote to memory of 2800 2972 vpppd.exe 9lxrxfl.exe PID 2972 wrote to memory of 2800 2972 vpppd.exe 9lxrxfl.exe PID 2972 wrote to memory of 2800 2972 vpppd.exe 9lxrxfl.exe PID 2972 wrote to memory of 2800 2972 vpppd.exe 9lxrxfl.exe PID 2800 wrote to memory of 2812 2800 9lxrxfl.exe nhhhnt.exe PID 2800 wrote to memory of 2812 2800 9lxrxfl.exe nhhhnt.exe PID 2800 wrote to memory of 2812 2800 9lxrxfl.exe nhhhnt.exe PID 2800 wrote to memory of 2812 2800 9lxrxfl.exe nhhhnt.exe PID 2812 wrote to memory of 2956 2812 nhhhnt.exe pjdvv.exe PID 2812 wrote to memory of 2956 2812 nhhhnt.exe pjdvv.exe PID 2812 wrote to memory of 2956 2812 nhhhnt.exe pjdvv.exe PID 2812 wrote to memory of 2956 2812 nhhhnt.exe pjdvv.exe PID 2956 wrote to memory of 812 2956 pjdvv.exe xrrfxxx.exe PID 2956 wrote to memory of 812 2956 pjdvv.exe xrrfxxx.exe PID 2956 wrote to memory of 812 2956 pjdvv.exe xrrfxxx.exe PID 2956 wrote to memory of 812 2956 pjdvv.exe xrrfxxx.exe PID 812 wrote to memory of 1264 812 xrrfxxx.exe 3rlllfl.exe PID 812 wrote to memory of 1264 812 xrrfxxx.exe 3rlllfl.exe PID 812 wrote to memory of 1264 812 xrrfxxx.exe 3rlllfl.exe PID 812 wrote to memory of 1264 812 xrrfxxx.exe 3rlllfl.exe PID 1264 wrote to memory of 2356 1264 3rlllfl.exe nhbnhn.exe PID 1264 wrote to memory of 2356 1264 3rlllfl.exe nhbnhn.exe PID 1264 wrote to memory of 2356 1264 3rlllfl.exe nhbnhn.exe PID 1264 wrote to memory of 2356 1264 3rlllfl.exe nhbnhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\9hhnnt.exec:\9hhnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\lrlrxlr.exec:\lrlrxlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\btnhnh.exec:\btnhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\pjdpj.exec:\pjdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bthtbt.exec:\bthtbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\1vjpp.exec:\1vjpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rrxrlxr.exec:\rrxrlxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\hhbnhn.exec:\hhbnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\vpppd.exec:\vpppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\9lxrxfl.exec:\9lxrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nhhhnt.exec:\nhhhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\pjdvv.exec:\pjdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xrrfxxx.exec:\xrrfxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\3rlllfl.exec:\3rlllfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\nhbnhn.exec:\nhbnhn.exe17⤵
- Executes dropped EXE
PID:2356 -
\??\c:\1vjpj.exec:\1vjpj.exe18⤵
- Executes dropped EXE
PID:1568 -
\??\c:\xlfrfrl.exec:\xlfrfrl.exe19⤵
- Executes dropped EXE
PID:768 -
\??\c:\1nnnbn.exec:\1nnnbn.exe20⤵
- Executes dropped EXE
PID:1208 -
\??\c:\pppvp.exec:\pppvp.exe21⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7fxflrx.exec:\7fxflrx.exe22⤵
- Executes dropped EXE
PID:2896 -
\??\c:\5bbbtn.exec:\5bbbtn.exe23⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vppjp.exec:\vppjp.exe24⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xfxlrfl.exec:\xfxlrfl.exe25⤵
- Executes dropped EXE
PID:696 -
\??\c:\hbhbhh.exec:\hbhbhh.exe26⤵
- Executes dropped EXE
PID:600 -
\??\c:\dvdjp.exec:\dvdjp.exe27⤵
- Executes dropped EXE
PID:1364 -
\??\c:\pvjvj.exec:\pvjvj.exe28⤵
- Executes dropped EXE
PID:780 -
\??\c:\ttnbnt.exec:\ttnbnt.exe29⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7pdjp.exec:\7pdjp.exe30⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1ffxfxf.exec:\1ffxfxf.exe31⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ttthbn.exec:\ttthbn.exe32⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bnnnnn.exec:\bnnnnn.exe33⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rlffxfr.exec:\rlffxfr.exe34⤵
- Executes dropped EXE
PID:1236 -
\??\c:\3rllrlr.exec:\3rllrlr.exe35⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nhbbtb.exec:\nhbbtb.exe36⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7jvjd.exec:\7jvjd.exe37⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fxlffxf.exec:\fxlffxf.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\llfrlxl.exec:\llfrlxl.exe39⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nnthbh.exec:\nnthbh.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ttbbbh.exec:\ttbbbh.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\djppj.exec:\djppj.exe42⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rxllxlr.exec:\rxllxlr.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ffxlflx.exec:\ffxlflx.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ttnnbn.exec:\ttnnbn.exe45⤵
- Executes dropped EXE
PID:2520 -
\??\c:\dvpvj.exec:\dvpvj.exe46⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vppjd.exec:\vppjd.exe47⤵
- Executes dropped EXE
PID:2240 -
\??\c:\3xlxrxl.exec:\3xlxrxl.exe48⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1fxrxfl.exec:\1fxrxfl.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hbtthn.exec:\hbtthn.exe50⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nhnthn.exec:\nhnthn.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vvvdp.exec:\vvvdp.exe52⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ffxllxx.exec:\ffxllxx.exe53⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fffrlrf.exec:\fffrlrf.exe54⤵
- Executes dropped EXE
PID:1676 -
\??\c:\bbhhth.exec:\bbhhth.exe55⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3pdjp.exec:\3pdjp.exe56⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vpvvv.exec:\vpvvv.exe57⤵
- Executes dropped EXE
PID:352 -
\??\c:\ffxflrx.exec:\ffxflrx.exe58⤵
- Executes dropped EXE
PID:772 -
\??\c:\xrxllfx.exec:\xrxllfx.exe59⤵
- Executes dropped EXE
PID:768 -
\??\c:\btntnh.exec:\btntnh.exe60⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vvpdj.exec:\vvpdj.exe61⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vjpjd.exec:\vjpjd.exe62⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1xrxflf.exec:\1xrxflf.exe63⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ttbbhh.exec:\ttbbhh.exe64⤵
- Executes dropped EXE
PID:604 -
\??\c:\ttnttt.exec:\ttnttt.exe65⤵
- Executes dropped EXE
PID:992 -
\??\c:\jjpdp.exec:\jjpdp.exe66⤵PID:268
-
\??\c:\lflrffr.exec:\lflrffr.exe67⤵PID:1508
-
\??\c:\9xxrxrx.exec:\9xxrxrx.exe68⤵PID:3068
-
\??\c:\thnhnh.exec:\thnhnh.exe69⤵PID:1900
-
\??\c:\vpppv.exec:\vpppv.exe70⤵PID:1360
-
\??\c:\3jpjj.exec:\3jpjj.exe71⤵PID:868
-
\??\c:\3rlrfff.exec:\3rlrfff.exe72⤵PID:2904
-
\??\c:\7htnbt.exec:\7htnbt.exe73⤵PID:1896
-
\??\c:\nbnbnt.exec:\nbnbnt.exe74⤵PID:304
-
\??\c:\pjvpp.exec:\pjvpp.exe75⤵PID:2044
-
\??\c:\vjpjj.exec:\vjpjj.exe76⤵PID:2212
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe77⤵PID:2188
-
\??\c:\1lfxllr.exec:\1lfxllr.exe78⤵PID:1596
-
\??\c:\9tnbtt.exec:\9tnbtt.exe79⤵PID:2392
-
\??\c:\9bbnbh.exec:\9bbnbh.exe80⤵PID:2648
-
\??\c:\5jdvd.exec:\5jdvd.exe81⤵PID:2608
-
\??\c:\1lrxfxf.exec:\1lrxfxf.exe82⤵PID:2612
-
\??\c:\lxfflfr.exec:\lxfflfr.exe83⤵PID:2676
-
\??\c:\hthbbb.exec:\hthbbb.exe84⤵PID:2736
-
\??\c:\hnhttb.exec:\hnhttb.exe85⤵PID:2748
-
\??\c:\vpvpp.exec:\vpvpp.exe86⤵PID:2708
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe87⤵PID:2100
-
\??\c:\flrfllr.exec:\flrfllr.exe88⤵PID:2484
-
\??\c:\5bnbhb.exec:\5bnbhb.exe89⤵PID:2968
-
\??\c:\pjvjp.exec:\pjvjp.exe90⤵PID:2632
-
\??\c:\vjjdd.exec:\vjjdd.exe91⤵PID:1956
-
\??\c:\xrlfffr.exec:\xrlfffr.exe92⤵PID:2800
-
\??\c:\bhhbnh.exec:\bhhbnh.exe93⤵PID:2776
-
\??\c:\jvdjv.exec:\jvdjv.exe94⤵PID:2952
-
\??\c:\vpdjj.exec:\vpdjj.exe95⤵PID:2532
-
\??\c:\9xffffr.exec:\9xffffr.exe96⤵PID:1748
-
\??\c:\lfrlfff.exec:\lfrlfff.exe97⤵PID:1672
-
\??\c:\tbhbbb.exec:\tbhbbb.exe98⤵PID:1264
-
\??\c:\3thtbt.exec:\3thtbt.exe99⤵PID:2096
-
\??\c:\jddpd.exec:\jddpd.exe100⤵PID:2552
-
\??\c:\7pdjp.exec:\7pdjp.exe101⤵PID:2784
-
\??\c:\7rxxrlr.exec:\7rxxrlr.exe102⤵PID:2712
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe103⤵PID:1552
-
\??\c:\htnhbb.exec:\htnhbb.exe104⤵PID:2052
-
\??\c:\jvjjp.exec:\jvjjp.exe105⤵PID:356
-
\??\c:\dvvpv.exec:\dvvpv.exe106⤵PID:2328
-
\??\c:\lfffllx.exec:\lfffllx.exe107⤵PID:2112
-
\??\c:\nhtbhn.exec:\nhtbhn.exe108⤵PID:3048
-
\??\c:\5bbntb.exec:\5bbntb.exe109⤵PID:1168
-
\??\c:\dpvvv.exec:\dpvvv.exe110⤵PID:1500
-
\??\c:\lfrxxxl.exec:\lfrxxxl.exe111⤵PID:1508
-
\??\c:\xlxrlrx.exec:\xlxrlrx.exe112⤵PID:1636
-
\??\c:\5tbhbn.exec:\5tbhbn.exe113⤵PID:1104
-
\??\c:\9jdjv.exec:\9jdjv.exe114⤵PID:1424
-
\??\c:\pjdjp.exec:\pjdjp.exe115⤵PID:1664
-
\??\c:\lfllxxf.exec:\lfllxxf.exe116⤵PID:1996
-
\??\c:\tnnbbb.exec:\tnnbbb.exe117⤵PID:1656
-
\??\c:\nhtbhh.exec:\nhtbhh.exe118⤵PID:2208
-
\??\c:\dpvdd.exec:\dpvdd.exe119⤵PID:2056
-
\??\c:\pdvvd.exec:\pdvvd.exe120⤵PID:348
-
\??\c:\xlrlrlf.exec:\xlrlrlf.exe121⤵PID:1628
-
\??\c:\ffrxxxf.exec:\ffrxxxf.exe122⤵PID:1256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-